4 ms·

Cool site! but: Get an SSL certificate so you serve over https https://letsencrypt.org/getting-started/ https://letsencrypt.org/getting-started/ "But I don't

Cool site! but: Get an SSL certificate so you serve over https https://letsencrypt.org/getting-started/ https://letsencrypt.org/getting-started/ "But I don't need a SSL...." Here's Why Your Static Website Needs HTTPS https://www.troyhunt.com/heres-why-your-static-website-needs-https/ https://www.troyhunt.com/heres-why-your-static-website-needs...

bspammer 8y ago
Looks like SSL is supported, they just don't auto upgrade requests.
- 1996 8y ago
  During tests, we found it was better to let people chose. You can use whatever method you feel more comfortable with. Sometime usability and security go in different way. We could do HSTS but if you took time to type http:// http:// maybe you really want http not https
  - gregmac 8y ago
    Why is it better to let people choose? That implies there is a downside to https:// https:// or a reason some people prefer http:// http:// -- can you elaborate? If you type just the domain name you get http:// http:// by default, which, in my experience, is how most people type in site URLs.
    - cryptoplot 8y ago
      People have their reasons, we respect that. But a default to https, why not? It seems reasonable to me. I am not sure on how to get https:// https:// by default while still supporting http:// http:// for people who prefer it. It may take some advanced 302 redirect. We will investigate and see what we can do there. Suggestions are much appreciated.
      - gregmac 8y ago
        I'm still very unclear on a legitimate use case for this, and personally wouldn't do it until I had a good reason. That said, a couple ideas on how to implement: * Use an alternate domain, eg `insecure.domain.com` * Use an alternate path prefix, eg `domain.com/insecure/` -- your app would have to be able to handle this * Use a parameter that sets a cookie that your load balancer/reverse proxy can understand, eg, `http://domain.com/?https=false` http://domain.com/?https=false`, and will prevent redirect -- definitely the most complex from the proxy point-of-view, but means the URL (other than the scheme) is consistent for both types of user
        exoesquitur 8y ago
        I sometimes parse web data with uC based devices that are not capable of doing https with the memory space available. I appreciate the ability to use http when I need to.
      - exoesquitur 8y ago
        I use http from embedded devices that cannot do https due to memory constraints. Http access is appreciated for this use case. But.... Do you guys have a business model that is going to keep you around long enough for me to bother hardcoding your api into embedded devices? I build things that connect real world actions to cryptocurrency markets, diverting power, metering resource consumption, etc.
        cryptoplot 8y ago
        Please get in touch by email if you need something more than the free API. For your embedded devices, we can make something special just for you
    - exoesquitur 8y ago
      I use http from embedded devices that cannot do https due to memory constraints. Http access is appreciated for this use case. But.... Do you guys have a business model that is going to keep you around long enough for me to bother hardcoding your api into embedded devices? I build things that connect real world actions to cryptocurrency markets, diverting power, metering resource consumption, etc.
      - exoesquitur 8y ago
        Oops wrong place, sorry.
        cryptoplot 8y ago
        No wrong question :-) Please get in touch by email if you need something special. If you have hard constraints, we can provide you with a special API returning only the value(s) you need so you do not even have to parse anything.
        halfjew22 8y ago
        GraphQL :) Not attempting to be snide, this sentiment echoes exactly what GraphQL solves.
      - cryptoplot 8y ago
        We plan to remain online for a long long time And if you make embedded devices using our API, maybe you need more than the free API? We sell access based on subscription for 0.1 BCH per month. Or maybe you need our 'special services'? From the FAQ: "I'm wealthy. I have very specific crazy needs!" "For the right price, the above rules may not apply to you. Right price means at least 1 BTC. If you can pay that, we can do many crazy things just for you"

bspammer 8y ago

Looks like SSL is supported, they just don't auto upgrade requests.

1996 8y ago
During tests, we found it was better to let people chose. You can use whatever method you feel more comfortable with. Sometime usability and security go in different way. We could do HSTS but if you took time to type http:// http:// maybe you really want http not https
- gregmac 8y ago
  Why is it better to let people choose? That implies there is a downside to https:// https:// or a reason some people prefer http:// http:// -- can you elaborate? If you type just the domain name you get http:// http:// by default, which, in my experience, is how most people type in site URLs.
  - cryptoplot 8y ago
    People have their reasons, we respect that. But a default to https, why not? It seems reasonable to me. I am not sure on how to get https:// https:// by default while still supporting http:// http:// for people who prefer it. It may take some advanced 302 redirect. We will investigate and see what we can do there. Suggestions are much appreciated.
    - gregmac 8y ago
      I'm still very unclear on a legitimate use case for this, and personally wouldn't do it until I had a good reason. That said, a couple ideas on how to implement: * Use an alternate domain, eg `insecure.domain.com` * Use an alternate path prefix, eg `domain.com/insecure/` -- your app would have to be able to handle this * Use a parameter that sets a cookie that your load balancer/reverse proxy can understand, eg, `http://domain.com/?https=false` http://domain.com/?https=false`, and will prevent redirect -- definitely the most complex from the proxy point-of-view, but means the URL (other than the scheme) is consistent for both types of user
      - exoesquitur 8y ago
        I sometimes parse web data with uC based devices that are not capable of doing https with the memory space available. I appreciate the ability to use http when I need to.
    - exoesquitur 8y ago
      I use http from embedded devices that cannot do https due to memory constraints. Http access is appreciated for this use case. But.... Do you guys have a business model that is going to keep you around long enough for me to bother hardcoding your api into embedded devices? I build things that connect real world actions to cryptocurrency markets, diverting power, metering resource consumption, etc.
      - cryptoplot 8y ago
        Please get in touch by email if you need something more than the free API. For your embedded devices, we can make something special just for you
  - exoesquitur 8y ago
    I use http from embedded devices that cannot do https due to memory constraints. Http access is appreciated for this use case. But.... Do you guys have a business model that is going to keep you around long enough for me to bother hardcoding your api into embedded devices? I build things that connect real world actions to cryptocurrency markets, diverting power, metering resource consumption, etc.
    - exoesquitur 8y ago
      Oops wrong place, sorry.
      - cryptoplot 8y ago
        No wrong question :-) Please get in touch by email if you need something special. If you have hard constraints, we can provide you with a special API returning only the value(s) you need so you do not even have to parse anything.
        halfjew22 8y ago
        GraphQL :) Not attempting to be snide, this sentiment echoes exactly what GraphQL solves.
    - cryptoplot 8y ago
      We plan to remain online for a long long time And if you make embedded devices using our API, maybe you need more than the free API? We sell access based on subscription for 0.1 BCH per month. Or maybe you need our 'special services'? From the FAQ: "I'm wealthy. I have very specific crazy needs!" "For the right price, the above rules may not apply to you. Right price means at least 1 BTC. If you can pay that, we can do many crazy things just for you"